The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructions and installer scripts encourage users to download and execute shell scripts directly from a remote GitHub repository using 'curl | sh'. Evidence: 'curl -fsSL https://raw.githubusercontent.com/BofAI/skills/v1.5.12-beta.12/twitter-mcp/install.sh | sh' in SKILL.md.
[COMMAND_EXECUTION]: The installation process uses AppleScript ('osascript') to open a full macOS Terminal window to execute commands. This technique is used to escape the restricted security sandbox of the AI agent and run code with the user's full local permissions. Evidence: 'osascript' block in 'install.sh' and 'scripts/install_xmcp.sh' that calls 'do script' to open Terminal.
[REMOTE_CODE_EXECUTION]: The skill performs global installation of a Node.js package from the npm registry at runtime. Evidence: 'npm install -g @xdevplatform/xurl' in 'scripts/install_xmcp.sh'.
[CREDENTIALS_UNSAFE]: The skill handles sensitive X/Twitter OAuth2 Client IDs and Secrets. While it prefers interactive prompts in a Terminal, it supports passing these secrets via environment variables, which can lead to exposure in shell history or logs. Evidence: 'X_MCP_CLIENT_ID' and 'X_MCP_CLIENT_SECRET' environment variables in 'SKILL.md'.
[PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection because it fetches and processes untrusted data (tweets, mentions, timeline) from X/Twitter and incorporates it into agent-generated summaries.
Ingestion points: 'xurl timeline', 'xurl mentions', 'xurl search' in 'SKILL.md'.
Boundary markers: None mentioned. No instructions are provided to the agent to treat fetched Twitter content as untrusted data or to ignore embedded instructions.
Capability inventory: The skill has access to the agent shell and file system via the installer and xurl CLI.
Sanitization: No sanitization or filtering of the fetched tweet content is performed before it is processed.

twitter-mcp